Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 9 Nov 2020 13:12:07 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r367520 - head/sys/netinet
Message-ID:  <202011091312.0A9DC7vT049690@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: tuexen
Date: Mon Nov  9 13:12:07 2020
New Revision: 367520
URL: https://svnweb.freebsd.org/changeset/base/367520

Log:
  Fix a potential use-after-free bug introduced in
  https://svnweb.freebsd.org/changeset/base/363046
  
  Thanks to Taylor Brandstetter for finding this issue using fuzz testing
  and reporting it in https://github.com/sctplab/usrsctp/issues/547

Modified:
  head/sys/netinet/sctp_indata.c

Modified: head/sys/netinet/sctp_indata.c
==============================================================================
--- head/sys/netinet/sctp_indata.c	Mon Nov  9 09:31:21 2020	(r367519)
+++ head/sys/netinet/sctp_indata.c	Mon Nov  9 13:12:07 2020	(r367520)
@@ -5494,7 +5494,7 @@ sctp_handle_forward_tsn(struct sctp_tcb *stcb,
 	unsigned int i, fwd_sz, m_size;
 	uint32_t str_seq;
 	struct sctp_stream_in *strm;
-	struct sctp_queued_to_read *control, *sv;
+	struct sctp_queued_to_read *control, *ncontrol, *sv;
 
 	asoc = &stcb->asoc;
 	if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
@@ -5654,14 +5654,14 @@ sctp_handle_forward_tsn(struct sctp_tcb *stcb,
 			}
 			strm = &asoc->strmin[sid];
 			if (ordered) {
-				TAILQ_FOREACH(control, &strm->inqueue, next_instrm) {
+				TAILQ_FOREACH_SAFE(control, &strm->inqueue, next_instrm, ncontrol) {
 					if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
 						sctp_flush_reassm_for_str_seq(stcb, asoc, strm, control, ordered, new_cum_tsn);
 					}
 				}
 			} else {
 				if (asoc->idata_supported) {
-					TAILQ_FOREACH(control, &strm->uno_inqueue, next_instrm) {
+					TAILQ_FOREACH_SAFE(control, &strm->uno_inqueue, next_instrm, ncontrol) {
 						if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
 							sctp_flush_reassm_for_str_seq(stcb, asoc, strm, control, ordered, new_cum_tsn);
 						}

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202011091312.0A9DC7vT049690>